Overview

overview

10

Static

static

10

BouncyCast...to.dll

windows7-x64

1

BouncyCast...to.dll

windows10-2004-x64

1

BurndownExt.dll

windows7-x64

3

BurndownExt.dll

windows10-2004-x64

3

Calendar.DayView.dll

windows7-x64

1

Calendar.DayView.dll

windows10-2004-x64

1

CalendarExt.dll

windows7-x64

3

CalendarExt.dll

windows10-2004-x64

3

CommandHandling.dll

windows7-x64

1

CommandHandling.dll

windows10-2004-x64

1

ConvertRTFToHTML.exe

windows7-x64

3

ConvertRTFToHTML.exe

windows10-2004-x64

3

CustomComboBox.dll

windows7-x64

1

CustomComboBox.dll

windows10-2004-x64

1

DayViewUIE...ge.dll

windows7-x64

3

DayViewUIE...ge.dll

windows10-2004-x64

3

DayViewUIE...re.dll

windows7-x64

3

DayViewUIE...re.dll

windows10-2004-x64

3

EncryptDecrypt.dll

windows7-x64

3

EncryptDecrypt.dll

windows10-2004-x64

3

EvidenceBo...ge.dll

windows7-x64

3

EvidenceBo...ge.dll

windows10-2004-x64

3

EvidenceBo...re.dll

windows7-x64

3

EvidenceBo...re.dll

windows10-2004-x64

3

FMindImportExport.dll

windows7-x64

3

FMindImportExport.dll

windows10-2004-x64

3

FtpStorage.dll

windows7-x64

3

FtpStorage.dll

windows10-2004-x64

3

GPExport.dll

windows7-x64

3

GPExport.dll

windows10-2004-x64

3

GanttChartExt.dll

windows7-x64

3

GanttChartExt.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    todolist_exe.zip

  • Size

    7.8MB

  • MD5

    412020a2717d73df5663acbd84bae2f5

  • SHA1

    dca090f60d7c74e7a2e7e0a2514ab3d78b10db85

  • SHA256

    303be7260ad8330508e98c77c51cc47c0c27a609f65b7aeff3444bf9f6062bd0

  • SHA512

    8edbf6de88ce5de662c461e31d34144a9e9349df049484fbaf13ab4df9b02b70450510490da9889cd3caafb63512de3e698eb4b8cf6d17df652d8b5db0d24d72

  • SSDEEP

    196608:Ks9ZQzYmJ7z4duFyNTnSiOuqqPcPIoX0WwGegTlapmNjv9AQsUa1JdHM3fdsNL:1UBoeyrOu3kPBX8GJTla4w7JdqFsNL

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://abstractspoon.pbworks.com/f/todolist_exe.zip

Signatures

  • Unsigned PE 60 IoCs

    Checks for missing Authenticode signature.

Files

  • todolist_exe.zip
    .zip

    Password: infected

  • BouncyCastle.Crypto.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • BurndownExt.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    4479eb21b633e560219120830cd849ea


    Headers

    Imports

    Exports

    Sections

  • Calendar.DayView.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • CalendarExt.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    42c183bac8ef9a37defa03d7ae8fce2b


    Headers

    Imports

    Exports

    Sections

  • CommandHandling.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ConvertRTFToHTML.exe
    .exe windows:4 windows x86 arch:x86

    Password: infected

    4acdaa8fd04b327d94b1ea36f2c7ebc8


    Headers

    Imports

    Sections

  • CustomComboBox.dll
    .dll windows:4 windows x86 arch:x86

    Password: infected

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • DayViewUIExtensionBridge.dll
    .dll windows:6 windows x86 arch:x86

    Password: infected

    d59cb0807befe220603cdb116418961f


    Headers

    Imports

    Exports

    Sections

  • DayViewUIExtensionCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • EncryptDecrypt.dll
    .dll windows:4 windows x86 arch:x86

    b519c8b33d3198f8917dcb361112bf3d


    Headers

    Imports

    Exports

    Sections

  • EvidenceBoardUIExtensionBridge.dll
    .dll windows:6 windows x86 arch:x86

    20ebf8492161cdd29f7605670267db96


    Headers

    Imports

    Exports

    Sections

  • EvidenceBoardUIExtensionCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • FMindImportExport.dll
    .dll windows:4 windows x86 arch:x86

    83a9bc035f76595a3efa233b95355148


    Headers

    Imports

    Exports

    Sections

  • FtpStorage.dll
    .dll windows:4 windows x86 arch:x86

    56680595901a0316a02968ff906e6897


    Headers

    Imports

    Exports

    Sections

  • GPExport.dll
    .dll windows:4 windows x86 arch:x86

    caaec5e82039dfe8c9ee37365bdb9a89


    Headers

    Imports

    Exports

    Sections

  • GanttChartExt.dll
    .dll windows:4 windows x86 arch:x86

    1571165e0d2da9a594612a1a04f45d1e


    Headers

    Imports

    Exports

    Sections

  • Gma.CodeCloud.Controls.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • HTMLContentControlBridge.dll
    .dll windows:6 windows x86 arch:x86

    1fe50ea8806963f5f51e5721f20cd2bc


    Headers

    Imports

    Exports

    Sections

  • HTMLContentControlCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • HTMLReportExporterBridge.dll
    .dll windows:6 windows x86 arch:x86

    4ea7f8dbdf9e18c8ebaa5a4a5a9d6ec2


    Headers

    Imports

    Exports

    Sections

  • HTMLReportExporterCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • HtmlAgilityPack.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • ImageHelper.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Install.Linux.txt
  • Install.Windows.txt
  • Itenso.Rtf.Converter.Html.dll
  • Itenso.Rtf.Interpreter.dll
  • Itenso.Rtf.Parser.dll
  • Itenso.Solutions.Community.Rtf2Html.dll
  • Itenso.Sys.dll
  • KanbanBoard.dll
    .dll windows:4 windows x86 arch:x86

    d43948a251dfc10c156a90f47698f872


    Headers

    Imports

    Exports

    Sections

  • LinkLabelEx.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MDContentControlBridge.dll
    .dll windows:6 windows x86 arch:x86

    1fe50ea8806963f5f51e5721f20cd2bc


    Headers

    Imports

    Exports

    Sections

  • MDContentControlCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MLOImport.dll
    .dll windows:4 windows x86 arch:x86

    d73b563520be33f3591d08e0846b182d


    Headers

    Imports

    Exports

    Sections

  • MSDN.HtmlEditorControl.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Markdig.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Microsoft.VisualStudio.OLE.Interop.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MindMapUIExtensionBridge.dll
    .dll windows:6 windows x86 arch:x86

    20ebf8492161cdd29f7605670267db96


    Headers

    Imports

    Exports

    Sections

  • MindMapUIExtensionCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • MySpellCheck.dll
    .dll windows:4 windows x86 arch:x86

    7b04dc4adf59543e58f7000066e4d579


    Headers

    Imports

    Exports

    Sections

  • PDFExporterBridge.dll
    .dll windows:6 windows x86 arch:x86

    4ea7f8dbdf9e18c8ebaa5a4a5a9d6ec2


    Headers

    Imports

    Exports

    Sections

  • PDFExporterCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • PlainTextImport.dll
    .dll windows:4 windows x86 arch:x86

    26340b4667312143ecc66bd3015dfaec


    Headers

    Imports

    Exports

    Sections

  • PluginHelpers.dll
    .dll windows:6 windows x86 arch:x86

    d20a95f336c06329af7ff2ea7ce9e3e2


    Headers

    Imports

    Sections

  • RTFContentCtrl.dll
    .dll windows:4 windows x86 arch:x86

    976b1e5967f614893b87920de27ff690


    Headers

    Imports

    Exports

    Sections

  • RadialTree.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Resources/Cursors/Locked.cur
  • Resources/Cursors/NoDrag.cur
  • Resources/Examples/Evidence Board Photos/beetle.jpg
    .jpg
  • Resources/Examples/Evidence Board Photos/doll.jpg
    .jpg
  • Resources/Examples/Evidence Board Photos/doors.jpg
    .jpg
  • Resources/Examples/Evidence Board Photos/typewriter.jpg
    .jpg
  • Resources/Examples/Evidence Board Photos/washing line.jpg
    .jpg
  • Resources/Examples/Evidence Board.tdl
  • Resources/Examples/Gantt Chart.tdl
  • Resources/Examples/Introduction.tdl
  • Resources/Examples/Introduction_Vietnamese.tdl
  • Resources/Examples/London Underground Photos/bank.jpg
    .jpg
  • Resources/Examples/London Underground Photos/edgwareroad.jpg
    .jpg
  • Resources/Examples/London Underground Photos/euston.jpg
    .jpg
  • Resources/Examples/London Underground Photos/farringdon.jpg
    .jpg
  • Resources/Examples/London Underground Photos/nottinghill.jpg
    .jpg
  • Resources/Examples/London Underground Photos/southken.jpg
    .jpg
  • Resources/Examples/London Underground Photos/temple.jpg
    .jpg
  • Resources/Examples/London Underground Photos/tubemap.png
    .png
  • Resources/Examples/London Underground Photos/westmin.jpg
    .jpg
  • Resources/Examples/London Underground.tdl
  • Resources/Examples/MeetingMinutes.rbt
    .js
  • Resources/Examples/Workload.tdl
  • Resources/Icons/sample.ico
  • Resources/Misc/Help.ini
  • Resources/Misc/IgnoreCrashDumps.reg
  • Resources/Misc/KeepCrashDumps.reg
  • Resources/Misc/ManualUpdater.ps1
    .ps1
  • Resources/Misc/README.txt
  • Resources/Misc/TdlSchema.xml
  • Resources/Misc/TdlSchema.xsd
  • Resources/Misc/UltramonCompatibilityFix.reg
  • Resources/Scripts/File Link Verifier/Online Help.url
    .url
  • Resources/Scripts/File Link Verifier/ToDoList_2004.ico
  • Resources/Scripts/File Link Verifier/examples/filiverto_test_cases.tdl
  • Resources/Scripts/File Link Verifier/filiverto.pyw
  • Resources/Stylesheets/Z_DetailedReport.xsl
    .xml
  • Resources/Stylesheets/Z_SimpleReport.xsl
    .xml
  • Resources/Stylesheets/Z_TimeSpentReport.xsl
    .xml
  • Resources/Stylesheets/tgEstimatesAndActuals_eng.xsl
    .xml
  • Resources/Stylesheets/tgEstimates_eng.xsl
    .xml
  • Resources/Themes/ThemeBeige.xml
  • Resources/Themes/ThemeBlue.Original.xml
  • Resources/Themes/ThemeBlue.xml
  • Resources/Themes/ThemeBlueXP.xml
  • Resources/Themes/ThemeGray.xml
  • Resources/Themes/ThemeGreen.xml
  • Resources/Themes/ThemeGreenXP.xml
  • Resources/Themes/ThemePurple.xml
  • Resources/Themes/ThemeSteel.xml
  • Resources/Themes/ThemeVS2010.Original.xml
  • Resources/Themes/ThemeVS2010.xml
  • Resources/Themes/ThemeWhite.Original.xml
  • Resources/Themes/ThemeWhite.xml
  • Resources/Themes/ThemeWin7Basic.xml
  • Resources/Translations/Danish (Denmark).WordCloud.Ignore.txt
  • Resources/Translations/Danish (Denmark).csv
  • Resources/Translations/Danish (Denmark).png
    .png
  • Resources/Translations/English (UK).WordCloud.Ignore.txt
  • Resources/Translations/English (US).WordCloud.Ignore.txt
  • Resources/Translations/English (US).csv
  • Resources/Translations/English (US).png
    .png
  • Resources/Translations/Francais (France).WordCloud.Ignore.txt
  • Resources/Translations/Francais (France).csv
  • Resources/Translations/Francais (France).png
    .png
  • Resources/Translations/German (Germany).WordCloud.Ignore.txt
  • Resources/Translations/German (Germany).csv
  • Resources/Translations/German (Germany).png
    .png
  • Resources/Translations/Greek (Greece).csv
  • Resources/Translations/Greek (Greece).png
    .png
  • Resources/Translations/Hangul (Korea).csv
  • Resources/Translations/Hangul (Korea).png
    .png
  • Resources/Translations/Hebrew (Israel).WordCloud.Ignore.txt
  • Resources/Translations/Hebrew (Israel).csv
  • Resources/Translations/Hebrew (Israel).png
    .png
  • Resources/Translations/Italiano (Italia).WordCloud.Ignore.txt
  • Resources/Translations/Italiano (Italia).csv
  • Resources/Translations/Italiano (Italia).png
    .png
  • Resources/Translations/Japanese (Japan).WordCloud.Ignore.txt
  • Resources/Translations/Japanese (Japan).csv
  • Resources/Translations/Japanese (Japan).png
    .png
  • Resources/Translations/Nederlands (Belgium).WordCloud.Ignore.txt
  • Resources/Translations/Nederlands (Belgium).csv
  • Resources/Translations/Nederlands (Belgium).png
    .png
  • Resources/Translations/Polish (Poland).WordCloud.Ignore.txt
  • Resources/Translations/Polish (Poland).csv
  • Resources/Translations/Polish (Poland).png
    .png
  • Resources/Translations/Russian (Russia).WordCloud.Ignore.txt
  • Resources/Translations/Russian (Russia).csv
  • Resources/Translations/Russian (Russia).png
    .png
  • Resources/Translations/Simplified Chinese (China).WordCloud.Ignore.txt
  • Resources/Translations/Simplified Chinese (China).csv
  • Resources/Translations/Simplified Chinese (China).png
    .png
  • Resources/Translations/Slovak (Slovensko).WordCloud.Ignore.txt
  • Resources/Translations/Slovak (Slovensko).csv
  • Resources/Translations/Slovak (Slovensko).png
    .png
  • Resources/Translations/Slovenian (Slovenia).WordCloud.Ignore.txt
  • Resources/Translations/Slovenian (Slovenia).csv
  • Resources/Translations/Slovenian (Slovenia).png
    .png
  • Resources/Translations/Spanish (Spain).WordCloud.Ignore.txt
  • Resources/Translations/Spanish (Spain).csv
  • Resources/Translations/Spanish (Spain).png
    .png
  • Resources/Translations/Ukrainian (Ukraine).csv
  • Resources/Translations/Ukrainian (Ukraine).png
    .png
  • Resources/Translations/Ukrainian (Ukriane).WordCloud.Ignore.txt
  • Resources/Translations/Vietnamese (Vietnam).csv
  • Resources/Translations/Vietnamese (Vietnam).png
    .png
  • Resources/Translations/YourLanguage.WordCloud.Ignore.txt
  • Resources/Translations/YourLanguage.csv
  • RichEditExtensions.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • Rtf2HtmlBridge.dll
  • ScrollHelper.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • SpreadsheetContentControlBridge.dll
    .dll windows:6 windows x86 arch:x86

    1fe50ea8806963f5f51e5721f20cd2bc


    Headers

    Imports

    Exports

    Sections

  • SpreadsheetContentControlCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • TDLTransEdit.exe
    .exe windows:4 windows x86 arch:x86

    d7aac8839ba90b27e0471d7f0e9d1ac0


    Headers

    Imports

    Sections

  • TDLUninstall.exe
    .exe windows:4 windows x86 arch:x86

    c37909ff516e0df16cf7b5a994dee190


    Headers

    Imports

    Sections

  • TDLUpdate.exe
    .exe windows:4 windows x86 arch:x86

    6dd85c13562d726a41176ab0155ac52f


    Headers

    Imports

    Sections

  • ToDoList.exe
    .exe windows:4 windows x86 arch:x86

    e0d220dbde80f0954215d5a3800bd7a3


    Headers

    Imports

    Sections

  • ToolStripToolTip.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • TransText.dll
    .dll windows:4 windows x86 arch:x86

    9871efef5eb5448f221bfe91c8e39a68


    Headers

    Imports

    Exports

    Sections

  • TreeViewHelper.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • UIComponents.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WebBrowserEx.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WordCloudUIExtensionBridge.dll
    .dll windows:6 windows x86 arch:x86

    d59cb0807befe220603cdb116418961f


    Headers

    Imports

    Exports

    Sections

  • WordCloudUIExtensionCore.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • WorkloadExt.dll
    .dll windows:4 windows x86 arch:x86

    23af479e31f11fb03dd4928b19d8773d


    Headers

    Imports

    Exports

    Sections

  • iCalImportExport.dll
    .dll windows:4 windows x86 arch:x86

    d2d8f5a7560d2e9b5b079a932fc8fa5e


    Headers

    Imports

    Exports

    Sections

  • iTextSharp.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • todolist.exe.xp.manifest
    .xml
  • unvell.ReoGrid.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • unvell.ReoGridEditorControl.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections